TenantLens

1.2.0

Rules/MFA-002.no-admin-without-mfa.psd1

                                @{

    Id          = 'MFA-002'

    Title       = 'Every administrator is registered for MFA'

    Area        = 'MfaRegistration'

    Severity    = 'Critical'

    References  = @(

        'CIS Microsoft 365 Foundations Benchmark (MFA for administrative roles)'

        'https://learn.microsoft.com/entra/identity/authentication/howto-authentication-methods-activity'

    )

    Rationale   = 'An admin account without a registered MFA method cannot be protected by any MFA requirement - and is exactly the account an attacker registers their own method into.'

    Remediation = 'Register MFA (ideally phishing-resistant) for every account holding an admin role, starting with Global Administrators.'

    Test        = {

        param($Snapshot)

        $summary = $Snapshot.MfaRegistration.summary

        if (-not $summary -or -not $summary.PSObject.Properties['adminsWithoutMfa']) {

            return New-TLRuleResult -Status Manual -Evidence 'Admin registration summary not present in the snapshot.'

        }

        $unregistered = [int]$summary.adminsWithoutMfa

        if ($unregistered -eq 0) {

            New-TLRuleResult -Status Pass -Evidence ("All {0} admin accounts are MFA-registered." -f $summary.adminCount)

        }

        else {

            $examples = @($Snapshot.MfaRegistration.users | Where-Object { $_.isAdmin -and -not $_.isMfaRegistered } |

                    Select-Object -First 10 | ForEach-Object { $_.userPrincipalName })

            New-TLRuleResult -Status Fail -Evidence (@("{0} of {1} admin accounts have no MFA registered." -f $unregistered, $summary.adminCount) + $examples)

        }

    }

}